@puzzle-ui/auth 0.0.0-stage → 0.5.0

package/dist/providers/mfa-provider.types.d.cts

@@ -0,0 +1,66 @@
+export type ProtectedAuthSecret = {
+  readonly ciphertext: string;
+  readonly iv: string;
+  readonly keyId: string;
+};
+export interface AuthSecretProtector {
+  encrypt(plaintext: string): Promise<ProtectedAuthSecret>;
+  decrypt(secret: ProtectedAuthSecret): Promise<string>;
+}
+export type WebAuthnOptionsJSON = Readonly<Record<string, unknown>>;
+export type WebAuthnRegistrationCredential = {
+  readonly credentialId: string;
+  readonly publicKey: string;
+  readonly counter: number;
+  readonly transports?: readonly string[];
+};
+export type WebAuthnRegistrationVerification = {
+  readonly verified: boolean;
+  readonly userVerified: boolean;
+  readonly credential?: WebAuthnRegistrationCredential;
+};
+export type WebAuthnAuthenticationVerification = {
+  readonly verified: boolean;
+  readonly userVerified: boolean;
+  readonly credentialId: string;
+  readonly newCounter: number;
+};
+/**
+ * Server-side WebAuthn adapter.
+ *
+ * Implement this with a maintained WebAuthn server implementation.
+ * The adapter is responsible for cryptographic verification, including
+ * signatures, challenge binding, origin, RP ID and authenticator data.
+ *
+ * All challenges must be supplied by Puzzle Auth rather than generated
+ * independently by the provider.
+ */
+export interface WebAuthnProvider {
+  generateRegistrationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly userId: string;
+    readonly userName: string;
+    readonly excludeCredentialIds: readonly string[];
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyRegistrationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+  }): Promise<WebAuthnRegistrationVerification>;
+  generateAuthenticationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly allowCredentialIds?: readonly string[];
+    readonly userVerification: "required";
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyAuthenticationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+    readonly credential: WebAuthnRegistrationCredential;
+  }): Promise<WebAuthnAuthenticationVerification>;
+}

package/dist/providers/mfa-provider.types.d.ts

@@ -0,0 +1,66 @@
+export type ProtectedAuthSecret = {
+  readonly ciphertext: string;
+  readonly iv: string;
+  readonly keyId: string;
+};
+export interface AuthSecretProtector {
+  encrypt(plaintext: string): Promise<ProtectedAuthSecret>;
+  decrypt(secret: ProtectedAuthSecret): Promise<string>;
+}
+export type WebAuthnOptionsJSON = Readonly<Record<string, unknown>>;
+export type WebAuthnRegistrationCredential = {
+  readonly credentialId: string;
+  readonly publicKey: string;
+  readonly counter: number;
+  readonly transports?: readonly string[];
+};
+export type WebAuthnRegistrationVerification = {
+  readonly verified: boolean;
+  readonly userVerified: boolean;
+  readonly credential?: WebAuthnRegistrationCredential;
+};
+export type WebAuthnAuthenticationVerification = {
+  readonly verified: boolean;
+  readonly userVerified: boolean;
+  readonly credentialId: string;
+  readonly newCounter: number;
+};
+/**
+ * Server-side WebAuthn adapter.
+ *
+ * Implement this with a maintained WebAuthn server implementation.
+ * The adapter is responsible for cryptographic verification, including
+ * signatures, challenge binding, origin, RP ID and authenticator data.
+ *
+ * All challenges must be supplied by Puzzle Auth rather than generated
+ * independently by the provider.
+ */
+export interface WebAuthnProvider {
+  generateRegistrationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly userId: string;
+    readonly userName: string;
+    readonly excludeCredentialIds: readonly string[];
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyRegistrationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+  }): Promise<WebAuthnRegistrationVerification>;
+  generateAuthenticationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly allowCredentialIds?: readonly string[];
+    readonly userVerification: "required";
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyAuthenticationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+    readonly credential: WebAuthnRegistrationCredential;
+  }): Promise<WebAuthnAuthenticationVerification>;
+}

package/dist/providers/provider.types.d.cts

@@ -0,0 +1,34 @@
+export type PasswordHash = {
+  readonly hash: string;
+  readonly algorithm: "argon2id";
+  readonly parameters: Readonly<Record<string, number | string>>;
+};
+export interface PasswordHasher {
+  hash(password: string): Promise<PasswordHash>;
+  verify(password: string, stored: PasswordHash): Promise<boolean>;
+}
+export type EmailMessage = {
+  readonly to: string;
+  readonly subject: string;
+  readonly template: string;
+  readonly variables: Readonly<Record<string, string>>;
+};
+export interface EmailProvider {
+  send(message: EmailMessage): Promise<void>;
+}
+export interface RateLimitProvider {
+  consume(input: {
+    readonly key: string;
+    readonly limit: number;
+    readonly windowSeconds: number;
+  }): Promise<{
+    readonly allowed: boolean;
+    readonly remaining: number;
+    readonly resetAt: Date;
+  }>;
+}
+export interface PasswordHasher {
+  hash(password: string): Promise<PasswordHash>;
+  verify(password: string, stored: PasswordHash): Promise<boolean>;
+  needsRehash?(stored: PasswordHash): boolean | Promise<boolean>;
+}

package/dist/providers/provider.types.d.ts

@@ -0,0 +1,34 @@
+export type PasswordHash = {
+  readonly hash: string;
+  readonly algorithm: "argon2id";
+  readonly parameters: Readonly<Record<string, number | string>>;
+};
+export interface PasswordHasher {
+  hash(password: string): Promise<PasswordHash>;
+  verify(password: string, stored: PasswordHash): Promise<boolean>;
+}
+export type EmailMessage = {
+  readonly to: string;
+  readonly subject: string;
+  readonly template: string;
+  readonly variables: Readonly<Record<string, string>>;
+};
+export interface EmailProvider {
+  send(message: EmailMessage): Promise<void>;
+}
+export interface RateLimitProvider {
+  consume(input: {
+    readonly key: string;
+    readonly limit: number;
+    readonly windowSeconds: number;
+  }): Promise<{
+    readonly allowed: boolean;
+    readonly remaining: number;
+    readonly resetAt: Date;
+  }>;
+}
+export interface PasswordHasher {
+  hash(password: string): Promise<PasswordHash>;
+  verify(password: string, stored: PasswordHash): Promise<boolean>;
+  needsRehash?(stored: PasswordHash): boolean | Promise<boolean>;
+}

package/dist/providers/simplewebauthn-provider.cjs

@@ -0,0 +1,185 @@
+const require_auth_errors = require("../errors/auth.errors.cjs");
+let _simplewebauthn_server = require("@simplewebauthn/server");
+// src/providers/simplewebauthn-provider.ts
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const isRecord = (value) => typeof value === "object" && value !== null;
+const encodeBase64Url = (input) => {
+	let output = "";
+	let index = 0;
+	while (index + 2 < input.length) {
+		const first = input[index++];
+		const second = input[index++];
+		const third = input[index++];
+		output += BASE64URL_ALPHABET.charAt(first >> 2);
+		output += BASE64URL_ALPHABET.charAt((first & 3) << 4 | second >> 4);
+		output += BASE64URL_ALPHABET.charAt((second & 15) << 2 | third >> 6);
+		output += BASE64URL_ALPHABET.charAt(third & 63);
+	}
+	if (index < input.length) {
+		const first = input[index++];
+		output += BASE64URL_ALPHABET.charAt(first >> 2);
+		if (index < input.length) {
+			const second = input[index];
+			output += BASE64URL_ALPHABET.charAt((first & 3) << 4 | second >> 4);
+			output += BASE64URL_ALPHABET.charAt((second & 15) << 2);
+		} else output += BASE64URL_ALPHABET.charAt((first & 3) << 4);
+	}
+	return output;
+};
+const decodeBase64Url = (value, errorMessage = "The stored passkey public key is invalid.") => {
+	if (typeof value !== "string" || value.length === 0 || value.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/.test(value)) throw new require_auth_errors.AuthValidationError(errorMessage);
+	const output = [];
+	let buffer = 0;
+	let bits = 0;
+	for (const character of value) {
+		const decoded = BASE64URL_ALPHABET.indexOf(character);
+		if (decoded < 0) throw new require_auth_errors.AuthValidationError(errorMessage);
+		buffer = buffer << 6 | decoded;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			output.push(buffer >>> bits & 255);
+		}
+	}
+	return new Uint8Array(output);
+};
+const toArrayBuffer = (bytes) => {
+	const buffer = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(buffer).set(bytes);
+	return buffer;
+};
+const toRegistrationResponse = (value) => {
+	if (!isRecord(value) || typeof value.id !== "string" || typeof value.rawId !== "string" || value.type !== "public-key" || !isRecord(value.response)) throw new require_auth_errors.AuthValidationError("The passkey registration response is invalid.");
+	return value;
+};
+const toAuthenticationResponse = (value) => {
+	if (!isRecord(value) || typeof value.id !== "string" || typeof value.rawId !== "string" || value.type !== "public-key" || !isRecord(value.response)) throw new require_auth_errors.AuthValidationError("The passkey authentication response is invalid.");
+	return value;
+};
+/**
+* Derives a stable, opaque WebAuthn user handle from the internal Puzzle user ID.
+*
+* WebAuthn user handles are bytes, not application IDs. Hashing also prevents
+* the internal user ID from being directly exposed in authenticator data.
+*/
+const deriveWebAuthnUserId = async (userId) => {
+	if (typeof userId !== "string" || userId.trim().length === 0) throw new require_auth_errors.AuthValidationError("A valid WebAuthn user ID is required.");
+	const cryptoApi = globalThis.crypto;
+	if (!cryptoApi?.subtle) throw new require_auth_errors.AuthConfigurationError("This runtime does not provide the required Web Crypto APIs.");
+	const input = new TextEncoder().encode(`puzzle-webauthn-user:v1:${userId}`);
+	const digest = await cryptoApi.subtle.digest("SHA-256", toArrayBuffer(input));
+	return new Uint8Array(digest);
+};
+const validateChallenge = (challenge) => {
+	if (typeof challenge !== "string" || challenge.length < 32 || challenge.length > 256 || !/^[A-Za-z0-9_-]+$/.test(challenge)) throw new require_auth_errors.AuthValidationError("A valid WebAuthn challenge is required.");
+};
+const validateRpId = (rpId) => {
+	if (typeof rpId !== "string" || rpId.trim().length === 0 || rpId.length > 253 || rpId.includes("/") || rpId.includes(":")) throw new require_auth_errors.AuthConfigurationError("The WebAuthn RP ID is invalid.");
+};
+var SimpleWebAuthnProvider = class {
+	async generateRegistrationOptions(input) {
+		validateChallenge(input.challenge);
+		validateRpId(input.rpId);
+		if (typeof input.rpName !== "string" || input.rpName.trim().length === 0 || typeof input.userName !== "string" || input.userName.trim().length === 0) throw new require_auth_errors.AuthValidationError("A WebAuthn RP name and user name are required.");
+		const excludeCredentials = input.excludeCredentialIds.map((id) => {
+			if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) throw new require_auth_errors.AuthValidationError("A stored passkey credential ID is invalid.");
+			return { id };
+		});
+		const options = await (0, _simplewebauthn_server.generateRegistrationOptions)({
+			rpID: input.rpId,
+			rpName: input.rpName.trim(),
+			userID: await deriveWebAuthnUserId(input.userId),
+			userName: input.userName.trim(),
+			userDisplayName: input.userName.trim(),
+			challenge: decodeBase64Url(input.challenge, "A valid WebAuthn challenge is required."),
+			attestationType: "none",
+			authenticatorSelection: {
+				residentKey: "required",
+				userVerification: "required"
+			},
+			excludeCredentials
+		});
+		if (options.challenge !== input.challenge) throw new require_auth_errors.AuthConfigurationError("SimpleWebAuthn returned an unexpected registration challenge.");
+		return options;
+	}
+	async verifyRegistrationResponse(input) {
+		validateChallenge(input.expectedChallenge);
+		validateRpId(input.expectedRpId);
+		if (typeof input.expectedOrigin !== "string" || input.expectedOrigin.length === 0) throw new require_auth_errors.AuthConfigurationError("A WebAuthn verification origin is required.");
+		const response = toRegistrationResponse(input.response);
+		const verification = await (0, _simplewebauthn_server.verifyRegistrationResponse)({
+			response,
+			expectedChallenge: input.expectedChallenge,
+			expectedOrigin: input.expectedOrigin,
+			expectedRPID: input.expectedRpId,
+			requireUserVerification: true
+		});
+		if (!verification.verified) return {
+			verified: false,
+			userVerified: false
+		};
+		const registration = verification.registrationInfo;
+		const credential = registration.credential;
+		return {
+			verified: true,
+			userVerified: registration.userVerified,
+			credential: {
+				credentialId: credential.id,
+				publicKey: encodeBase64Url(credential.publicKey),
+				counter: credential.counter,
+				transports: credential.transports ?? []
+			}
+		};
+	}
+	async generateAuthenticationOptions(input) {
+		validateChallenge(input.challenge);
+		validateRpId(input.rpId);
+		const allowCredentials = input.allowCredentialIds?.map((id) => {
+			if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) throw new require_auth_errors.AuthValidationError("A stored passkey credential ID is invalid.");
+			return { id };
+		});
+		const options = await (0, _simplewebauthn_server.generateAuthenticationOptions)({
+			rpID: input.rpId,
+			challenge: decodeBase64Url(input.challenge, "A valid WebAuthn challenge is required."),
+			userVerification: "required",
+			...allowCredentials ? { allowCredentials } : {}
+		});
+		if (options.challenge !== input.challenge) throw new require_auth_errors.AuthConfigurationError("SimpleWebAuthn returned an unexpected authentication challenge.");
+		return options;
+	}
+	async verifyAuthenticationResponse(input) {
+		validateChallenge(input.expectedChallenge);
+		validateRpId(input.expectedRpId);
+		if (typeof input.expectedOrigin !== "string" || input.expectedOrigin.length === 0) throw new require_auth_errors.AuthConfigurationError("A WebAuthn verification origin is required.");
+		const response = toAuthenticationResponse(input.response);
+		if (response.id !== input.credential.credentialId) return {
+			verified: false,
+			userVerified: false,
+			credentialId: response.id,
+			newCounter: input.credential.counter
+		};
+		if (!Number.isSafeInteger(input.credential.counter) || input.credential.counter < 0) throw new require_auth_errors.AuthValidationError("The stored passkey counter is invalid.");
+		const credential = {
+			id: input.credential.credentialId,
+			publicKey: decodeBase64Url(input.credential.publicKey),
+			counter: input.credential.counter
+		};
+		const verification = await (0, _simplewebauthn_server.verifyAuthenticationResponse)({
+			response,
+			expectedChallenge: input.expectedChallenge,
+			expectedOrigin: input.expectedOrigin,
+			expectedRPID: input.expectedRpId,
+			credential,
+			requireUserVerification: true
+		});
+		return {
+			verified: verification.verified,
+			userVerified: verification.verified && verification.authenticationInfo.userVerified,
+			credentialId: verification.authenticationInfo.credentialID,
+			newCounter: verification.authenticationInfo.newCounter
+		};
+	}
+};
+exports.SimpleWebAuthnProvider = SimpleWebAuthnProvider;
+
+//# sourceMappingURL=simplewebauthn-provider.cjs.map

package/dist/providers/simplewebauthn-provider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn-provider.cjs","names":["AuthValidationError","AuthConfigurationError","generateRegistrationOptions","verifyRegistrationResponse","generateAuthenticationOptions","verifyAuthenticationResponse"],"sources":["../../src/providers/simplewebauthn-provider.ts"],"sourcesContent":["import {\n  generateAuthenticationOptions,\n  generateRegistrationOptions,\n  verifyAuthenticationResponse,\n  verifyRegistrationResponse,\n  type AuthenticationResponseJSON,\n  type RegistrationResponseJSON,\n  type WebAuthnCredential,\n} from \"@simplewebauthn/server\";\n\nimport {\n  AuthConfigurationError,\n  AuthValidationError,\n} from \"../errors/auth.errors\";\n\nimport type {\n  WebAuthnAuthenticationVerification,\n  WebAuthnOptionsJSON,\n  WebAuthnProvider,\n  WebAuthnRegistrationVerification,\n} from \"./mfa-provider.types\";\n\nconst BASE64URL_ALPHABET =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null;\n\nconst encodeBase64Url = (input: Uint8Array): string => {\n  let output = \"\";\n  let index = 0;\n\n  while (index + 2 < input.length) {\n    const first = input[index++]!;\n    const second = input[index++]!;\n    const third = input[index++]!;\n\n    output += BASE64URL_ALPHABET.charAt(first >> 2);\n    output += BASE64URL_ALPHABET.charAt(((first & 3) << 4) | (second >> 4));\n    output += BASE64URL_ALPHABET.charAt(((second & 15) << 2) | (third >> 6));\n    output += BASE64URL_ALPHABET.charAt(third & 63);\n  }\n\n  if (index < input.length) {\n    const first = input[index++]!;\n\n    output += BASE64URL_ALPHABET.charAt(first >> 2);\n\n    if (index < input.length) {\n      const second = input[index]!;\n\n      output += BASE64URL_ALPHABET.charAt(((first & 3) << 4) | (second >> 4));\n      output += BASE64URL_ALPHABET.charAt((second & 15) << 2);\n    } else {\n      output += BASE64URL_ALPHABET.charAt((first & 3) << 4);\n    }\n  }\n\n  return output;\n};\n\nconst decodeBase64Url = (\n  value: string,\n  errorMessage = \"The stored passkey public key is invalid.\",\n): Uint8Array<ArrayBuffer> => {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    value.length % 4 === 1 ||\n    !/^[A-Za-z0-9_-]+$/.test(value)\n  ) {\n    throw new AuthValidationError(errorMessage);\n  }\n\n  const output: number[] = [];\n  let buffer = 0;\n  let bits = 0;\n\n  for (const character of value) {\n    const decoded = BASE64URL_ALPHABET.indexOf(character);\n\n    if (decoded < 0) {\n      throw new AuthValidationError(errorMessage);\n    }\n\n    buffer = (buffer << 6) | decoded;\n    bits += 6;\n\n    if (bits >= 8) {\n      bits -= 8;\n      output.push((buffer >>> bits) & 255);\n    }\n  }\n\n  return new Uint8Array(output);\n};\n\nconst toArrayBuffer = (bytes: Uint8Array): ArrayBuffer => {\n  const buffer = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(buffer).set(bytes);\n\n  return buffer;\n};\n\nconst toRegistrationResponse = (value: unknown): RegistrationResponseJSON => {\n  if (\n    !isRecord(value) ||\n    typeof value.id !== \"string\" ||\n    typeof value.rawId !== \"string\" ||\n    value.type !== \"public-key\" ||\n    !isRecord(value.response)\n  ) {\n    throw new AuthValidationError(\n      \"The passkey registration response is invalid.\",\n    );\n  }\n\n  return value as unknown as RegistrationResponseJSON;\n};\n\nconst toAuthenticationResponse = (\n  value: unknown,\n): AuthenticationResponseJSON => {\n  if (\n    !isRecord(value) ||\n    typeof value.id !== \"string\" ||\n    typeof value.rawId !== \"string\" ||\n    value.type !== \"public-key\" ||\n    !isRecord(value.response)\n  ) {\n    throw new AuthValidationError(\n      \"The passkey authentication response is invalid.\",\n    );\n  }\n\n  return value as unknown as AuthenticationResponseJSON;\n};\n\n/**\n * Derives a stable, opaque WebAuthn user handle from the internal Puzzle user ID.\n *\n * WebAuthn user handles are bytes, not application IDs. Hashing also prevents\n * the internal user ID from being directly exposed in authenticator data.\n */\nconst deriveWebAuthnUserId = async (\n  userId: string,\n): Promise<Uint8Array<ArrayBuffer>> => {\n  if (typeof userId !== \"string\" || userId.trim().length === 0) {\n    throw new AuthValidationError(\"A valid WebAuthn user ID is required.\");\n  }\n\n  const cryptoApi = globalThis.crypto;\n\n  if (!cryptoApi?.subtle) {\n    throw new AuthConfigurationError(\n      \"This runtime does not provide the required Web Crypto APIs.\",\n    );\n  }\n\n  const input = new TextEncoder().encode(`puzzle-webauthn-user:v1:${userId}`);\n\n  const digest = await cryptoApi.subtle.digest(\"SHA-256\", toArrayBuffer(input));\n\n  return new Uint8Array(digest);\n};\n\nconst validateChallenge = (challenge: string): void => {\n  if (\n    typeof challenge !== \"string\" ||\n    challenge.length < 32 ||\n    challenge.length > 256 ||\n    !/^[A-Za-z0-9_-]+$/.test(challenge)\n  ) {\n    throw new AuthValidationError(\"A valid WebAuthn challenge is required.\");\n  }\n};\n\nconst validateRpId = (rpId: string): void => {\n  if (\n    typeof rpId !== \"string\" ||\n    rpId.trim().length === 0 ||\n    rpId.length > 253 ||\n    rpId.includes(\"/\") ||\n    rpId.includes(\":\")\n  ) {\n    throw new AuthConfigurationError(\"The WebAuthn RP ID is invalid.\");\n  }\n};\n\nexport class SimpleWebAuthnProvider implements WebAuthnProvider {\n  async generateRegistrationOptions(input: {\n    readonly challenge: string;\n    readonly rpId: string;\n    readonly rpName: string;\n    readonly userId: string;\n    readonly userName: string;\n    readonly excludeCredentialIds: readonly string[];\n  }): Promise<WebAuthnOptionsJSON> {\n    validateChallenge(input.challenge);\n    validateRpId(input.rpId);\n\n    if (\n      typeof input.rpName !== \"string\" ||\n      input.rpName.trim().length === 0 ||\n      typeof input.userName !== \"string\" ||\n      input.userName.trim().length === 0\n    ) {\n      throw new AuthValidationError(\n        \"A WebAuthn RP name and user name are required.\",\n      );\n    }\n\n    const excludeCredentials = input.excludeCredentialIds.map((id) => {\n      if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) {\n        throw new AuthValidationError(\n          \"A stored passkey credential ID is invalid.\",\n        );\n      }\n\n      return { id };\n    });\n\n    const options = await generateRegistrationOptions({\n      rpID: input.rpId,\n      rpName: input.rpName.trim(),\n      userID: await deriveWebAuthnUserId(input.userId),\n      userName: input.userName.trim(),\n      userDisplayName: input.userName.trim(),\n      challenge: decodeBase64Url(\n        input.challenge,\n        \"A valid WebAuthn challenge is required.\",\n      ),\n      attestationType: \"none\",\n      authenticatorSelection: {\n        residentKey: \"required\",\n        userVerification: \"required\",\n      },\n      excludeCredentials,\n    });\n\n    if (options.challenge !== input.challenge) {\n      throw new AuthConfigurationError(\n        \"SimpleWebAuthn returned an unexpected registration challenge.\",\n      );\n    }\n\n    return options as unknown as WebAuthnOptionsJSON;\n  }\n\n  async verifyRegistrationResponse(input: {\n    readonly response: unknown;\n    readonly expectedChallenge: string;\n    readonly expectedOrigin: string;\n    readonly expectedRpId: string;\n  }): Promise<WebAuthnRegistrationVerification> {\n    validateChallenge(input.expectedChallenge);\n    validateRpId(input.expectedRpId);\n\n    if (\n      typeof input.expectedOrigin !== \"string\" ||\n      input.expectedOrigin.length === 0\n    ) {\n      throw new AuthConfigurationError(\n        \"A WebAuthn verification origin is required.\",\n      );\n    }\n\n    const response = toRegistrationResponse(input.response);\n\n    const verification = await verifyRegistrationResponse({\n      response,\n      expectedChallenge: input.expectedChallenge,\n      expectedOrigin: input.expectedOrigin,\n      expectedRPID: input.expectedRpId,\n      requireUserVerification: true,\n    });\n\n    if (!verification.verified) {\n      return {\n        verified: false,\n        userVerified: false,\n      };\n    }\n\n    const registration = verification.registrationInfo;\n    const credential = registration.credential;\n\n    return {\n      verified: true,\n      userVerified: registration.userVerified,\n      credential: {\n        credentialId: credential.id,\n        publicKey: encodeBase64Url(credential.publicKey),\n        counter: credential.counter,\n        transports: credential.transports ?? [],\n      },\n    };\n  }\n\n  async generateAuthenticationOptions(input: {\n    readonly challenge: string;\n    readonly rpId: string;\n    readonly allowCredentialIds?: readonly string[];\n    readonly userVerification: \"required\";\n  }): Promise<WebAuthnOptionsJSON> {\n    validateChallenge(input.challenge);\n    validateRpId(input.rpId);\n\n    const allowCredentials = input.allowCredentialIds?.map((id) => {\n      if (!id || !/^[A-Za-z0-9_-]+$/.test(id)) {\n        throw new AuthValidationError(\n          \"A stored passkey credential ID is invalid.\",\n        );\n      }\n\n      return { id };\n    });\n\n    const options = await generateAuthenticationOptions({\n      rpID: input.rpId,\n      challenge: decodeBase64Url(\n        input.challenge,\n        \"A valid WebAuthn challenge is required.\",\n      ),\n      userVerification: \"required\",\n      ...(allowCredentials\n        ? {\n            allowCredentials,\n          }\n        : {}),\n    });\n\n    if (options.challenge !== input.challenge) {\n      throw new AuthConfigurationError(\n        \"SimpleWebAuthn returned an unexpected authentication challenge.\",\n      );\n    }\n\n    return options as unknown as WebAuthnOptionsJSON;\n  }\n\n  async verifyAuthenticationResponse(input: {\n    readonly response: unknown;\n    readonly expectedChallenge: string;\n    readonly expectedOrigin: string;\n    readonly expectedRpId: string;\n    readonly credential: {\n      readonly credentialId: string;\n      readonly publicKey: string;\n      readonly counter: number;\n      readonly transports?: readonly string[];\n    };\n  }): Promise<WebAuthnAuthenticationVerification> {\n    validateChallenge(input.expectedChallenge);\n    validateRpId(input.expectedRpId);\n\n    if (\n      typeof input.expectedOrigin !== \"string\" ||\n      input.expectedOrigin.length === 0\n    ) {\n      throw new AuthConfigurationError(\n        \"A WebAuthn verification origin is required.\",\n      );\n    }\n\n    const response = toAuthenticationResponse(input.response);\n\n    if (response.id !== input.credential.credentialId) {\n      return {\n        verified: false,\n        userVerified: false,\n        credentialId: response.id,\n        newCounter: input.credential.counter,\n      };\n    }\n\n    if (\n      !Number.isSafeInteger(input.credential.counter) ||\n      input.credential.counter < 0\n    ) {\n      throw new AuthValidationError(\"The stored passkey counter is invalid.\");\n    }\n\n    const credential: WebAuthnCredential = {\n      id: input.credential.credentialId,\n      publicKey: decodeBase64Url(input.credential.publicKey),\n      counter: input.credential.counter,\n    };\n\n    const verification = await verifyAuthenticationResponse({\n      response,\n      expectedChallenge: input.expectedChallenge,\n      expectedOrigin: input.expectedOrigin,\n      expectedRPID: input.expectedRpId,\n      credential,\n      requireUserVerification: true,\n    });\n\n    return {\n      verified: verification.verified,\n      userVerified:\n        verification.verified && verification.authenticationInfo.userVerified,\n      credentialId: verification.authenticationInfo.credentialID,\n      newCounter: verification.authenticationInfo.newCounter,\n    };\n  }\n}\n"],"mappings":";;;AAsBA,MAAM,qBACJ;AAEF,MAAM,YAAY,UAChB,OAAO,UAAU,YAAY,UAAU;AAEzC,MAAM,mBAAmB,UAA8B;CACrD,IAAI,SAAS;CACb,IAAI,QAAQ;CAEZ,OAAO,QAAQ,IAAI,MAAM,QAAQ;EAC/B,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM;EACrB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,OAAO,SAAS,CAAC;EAC9C,UAAU,mBAAmB,QAAS,QAAQ,MAAM,IAAM,UAAU,CAAE;EACtE,UAAU,mBAAmB,QAAS,SAAS,OAAO,IAAM,SAAS,CAAE;EACvE,UAAU,mBAAmB,OAAO,QAAQ,EAAE;CAChD;CAEA,IAAI,QAAQ,MAAM,QAAQ;EACxB,MAAM,QAAQ,MAAM;EAEpB,UAAU,mBAAmB,OAAO,SAAS,CAAC;EAE9C,IAAI,QAAQ,MAAM,QAAQ;GACxB,MAAM,SAAS,MAAM;GAErB,UAAU,mBAAmB,QAAS,QAAQ,MAAM,IAAM,UAAU,CAAE;GACtE,UAAU,mBAAmB,QAAQ,SAAS,OAAO,CAAC;EACxD,OACE,UAAU,mBAAmB,QAAQ,QAAQ,MAAM,CAAC;CAExD;CAEA,OAAO;AACT;AAEA,MAAM,mBACJ,OACA,eAAe,gDACa;CAC5B,IACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,MAAM,SAAS,MAAM,KACrB,CAAC,mBAAmB,KAAK,KAAK,GAE9B,MAAM,IAAIA,oBAAAA,oBAAoB,YAAY;CAG5C,MAAM,SAAmB,CAAC;CAC1B,IAAI,SAAS;CACb,IAAI,OAAO;CAEX,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,UAAU,mBAAmB,QAAQ,SAAS;EAEpD,IAAI,UAAU,GACZ,MAAM,IAAIA,oBAAAA,oBAAoB,YAAY;EAG5C,SAAU,UAAU,IAAK;EACzB,QAAQ;EAER,IAAI,QAAQ,GAAG;GACb,QAAQ;GACR,OAAO,KAAM,WAAW,OAAQ,GAAG;EACrC;CACF;CAEA,OAAO,IAAI,WAAW,MAAM;AAC9B;AAEA,MAAM,iBAAiB,UAAmC;CACxD,MAAM,SAAS,IAAI,YAAY,MAAM,UAAU;CAC/C,IAAI,WAAW,MAAM,CAAC,CAAC,IAAI,KAAK;CAEhC,OAAO;AACT;AAEA,MAAM,0BAA0B,UAA6C;CAC3E,IACE,CAAC,SAAS,KAAK,KACf,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,UAAU,YACvB,MAAM,SAAS,gBACf,CAAC,SAAS,MAAM,QAAQ,GAExB,MAAM,IAAIA,oBAAAA,oBACR,+CACF;CAGF,OAAO;AACT;AAEA,MAAM,4BACJ,UAC+B;CAC/B,IACE,CAAC,SAAS,KAAK,KACf,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,UAAU,YACvB,MAAM,SAAS,gBACf,CAAC,SAAS,MAAM,QAAQ,GAExB,MAAM,IAAIA,oBAAAA,oBACR,iDACF;CAGF,OAAO;AACT;;;;;;;AAQA,MAAM,uBAAuB,OAC3B,WACqC;CACrC,IAAI,OAAO,WAAW,YAAY,OAAO,KAAK,CAAC,CAAC,WAAW,GACzD,MAAM,IAAIA,oBAAAA,oBAAoB,uCAAuC;CAGvE,MAAM,YAAY,WAAW;CAE7B,IAAI,CAAC,WAAW,QACd,MAAM,IAAIC,oBAAAA,uBACR,6DACF;CAGF,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,2BAA2B,QAAQ;CAE1E,MAAM,SAAS,MAAM,UAAU,OAAO,OAAO,WAAW,cAAc,KAAK,CAAC;CAE5E,OAAO,IAAI,WAAW,MAAM;AAC9B;AAEA,MAAM,qBAAqB,cAA4B;CACrD,IACE,OAAO,cAAc,YACrB,UAAU,SAAS,MACnB,UAAU,SAAS,OACnB,CAAC,mBAAmB,KAAK,SAAS,GAElC,MAAM,IAAID,oBAAAA,oBAAoB,yCAAyC;AAE3E;AAEA,MAAM,gBAAgB,SAAuB;CAC3C,IACE,OAAO,SAAS,YAChB,KAAK,KAAK,CAAC,CAAC,WAAW,KACvB,KAAK,SAAS,OACd,KAAK,SAAS,GAAG,KACjB,KAAK,SAAS,GAAG,GAEjB,MAAM,IAAIC,oBAAAA,uBAAuB,gCAAgC;AAErE;AAEA,IAAa,yBAAb,MAAgE;CAC9D,MAAM,4BAA4B,OAOD;EAC/B,kBAAkB,MAAM,SAAS;EACjC,aAAa,MAAM,IAAI;EAEvB,IACE,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,KAAK,CAAC,CAAC,WAAW,KAC/B,OAAO,MAAM,aAAa,YAC1B,MAAM,SAAS,KAAK,CAAC,CAAC,WAAW,GAEjC,MAAM,IAAID,oBAAAA,oBACR,gDACF;EAGF,MAAM,qBAAqB,MAAM,qBAAqB,KAAK,OAAO;GAChE,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,EAAE,GACpC,MAAM,IAAIA,oBAAAA,oBACR,4CACF;GAGF,OAAO,EAAE,GAAG;EACd,CAAC;EAED,MAAM,UAAU,OAAA,GAAME,uBAAAA,4BAAAA,CAA4B;GAChD,MAAM,MAAM;GACZ,QAAQ,MAAM,OAAO,KAAK;GAC1B,QAAQ,MAAM,qBAAqB,MAAM,MAAM;GAC/C,UAAU,MAAM,SAAS,KAAK;GAC9B,iBAAiB,MAAM,SAAS,KAAK;GACrC,WAAW,gBACT,MAAM,WACN,yCACF;GACA,iBAAiB;GACjB,wBAAwB;IACtB,aAAa;IACb,kBAAkB;GACpB;GACA;EACF,CAAC;EAED,IAAI,QAAQ,cAAc,MAAM,WAC9B,MAAM,IAAID,oBAAAA,uBACR,+DACF;EAGF,OAAO;CACT;CAEA,MAAM,2BAA2B,OAKa;EAC5C,kBAAkB,MAAM,iBAAiB;EACzC,aAAa,MAAM,YAAY;EAE/B,IACE,OAAO,MAAM,mBAAmB,YAChC,MAAM,eAAe,WAAW,GAEhC,MAAM,IAAIA,oBAAAA,uBACR,6CACF;EAGF,MAAM,WAAW,uBAAuB,MAAM,QAAQ;EAEtD,MAAM,eAAe,OAAA,GAAME,uBAAAA,2BAAAA,CAA2B;GACpD;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM;GACtB,cAAc,MAAM;GACpB,yBAAyB;EAC3B,CAAC;EAED,IAAI,CAAC,aAAa,UAChB,OAAO;GACL,UAAU;GACV,cAAc;EAChB;EAGF,MAAM,eAAe,aAAa;EAClC,MAAM,aAAa,aAAa;EAEhC,OAAO;GACL,UAAU;GACV,cAAc,aAAa;GAC3B,YAAY;IACV,cAAc,WAAW;IACzB,WAAW,gBAAgB,WAAW,SAAS;IAC/C,SAAS,WAAW;IACpB,YAAY,WAAW,cAAc,CAAC;GACxC;EACF;CACF;CAEA,MAAM,8BAA8B,OAKH;EAC/B,kBAAkB,MAAM,SAAS;EACjC,aAAa,MAAM,IAAI;EAEvB,MAAM,mBAAmB,MAAM,oBAAoB,KAAK,OAAO;GAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,EAAE,GACpC,MAAM,IAAIH,oBAAAA,oBACR,4CACF;GAGF,OAAO,EAAE,GAAG;EACd,CAAC;EAED,MAAM,UAAU,OAAA,GAAMI,uBAAAA,8BAAAA,CAA8B;GAClD,MAAM,MAAM;GACZ,WAAW,gBACT,MAAM,WACN,yCACF;GACA,kBAAkB;GAClB,GAAI,mBACA,EACE,iBACF,IACA,CAAC;EACP,CAAC;EAED,IAAI,QAAQ,cAAc,MAAM,WAC9B,MAAM,IAAIH,oBAAAA,uBACR,iEACF;EAGF,OAAO;CACT;CAEA,MAAM,6BAA6B,OAWa;EAC9C,kBAAkB,MAAM,iBAAiB;EACzC,aAAa,MAAM,YAAY;EAE/B,IACE,OAAO,MAAM,mBAAmB,YAChC,MAAM,eAAe,WAAW,GAEhC,MAAM,IAAIA,oBAAAA,uBACR,6CACF;EAGF,MAAM,WAAW,yBAAyB,MAAM,QAAQ;EAExD,IAAI,SAAS,OAAO,MAAM,WAAW,cACnC,OAAO;GACL,UAAU;GACV,cAAc;GACd,cAAc,SAAS;GACvB,YAAY,MAAM,WAAW;EAC/B;EAGF,IACE,CAAC,OAAO,cAAc,MAAM,WAAW,OAAO,KAC9C,MAAM,WAAW,UAAU,GAE3B,MAAM,IAAID,oBAAAA,oBAAoB,wCAAwC;EAGxE,MAAM,aAAiC;GACrC,IAAI,MAAM,WAAW;GACrB,WAAW,gBAAgB,MAAM,WAAW,SAAS;GACrD,SAAS,MAAM,WAAW;EAC5B;EAEA,MAAM,eAAe,OAAA,GAAMK,uBAAAA,6BAAAA,CAA6B;GACtD;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM;GACtB,cAAc,MAAM;GACpB;GACA,yBAAyB;EAC3B,CAAC;EAED,OAAO;GACL,UAAU,aAAa;GACvB,cACE,aAAa,YAAY,aAAa,mBAAmB;GAC3D,cAAc,aAAa,mBAAmB;GAC9C,YAAY,aAAa,mBAAmB;EAC9C;CACF;AACF"}

package/dist/providers/simplewebauthn-provider.d.cts

@@ -0,0 +1,35 @@
+import { WebAuthnAuthenticationVerification, WebAuthnOptionsJSON, WebAuthnProvider, WebAuthnRegistrationVerification } from "./mfa-provider.types.cjs";
+export declare class SimpleWebAuthnProvider implements WebAuthnProvider {
+  generateRegistrationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly userId: string;
+    readonly userName: string;
+    readonly excludeCredentialIds: readonly string[];
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyRegistrationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+  }): Promise<WebAuthnRegistrationVerification>;
+  generateAuthenticationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly allowCredentialIds?: readonly string[];
+    readonly userVerification: "required";
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyAuthenticationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+    readonly credential: {
+      readonly credentialId: string;
+      readonly publicKey: string;
+      readonly counter: number;
+      readonly transports?: readonly string[];
+    };
+  }): Promise<WebAuthnAuthenticationVerification>;
+}

package/dist/providers/simplewebauthn-provider.d.ts

@@ -0,0 +1,35 @@
+import { WebAuthnAuthenticationVerification, WebAuthnOptionsJSON, WebAuthnProvider, WebAuthnRegistrationVerification } from "./mfa-provider.types.js";
+export declare class SimpleWebAuthnProvider implements WebAuthnProvider {
+  generateRegistrationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly rpName: string;
+    readonly userId: string;
+    readonly userName: string;
+    readonly excludeCredentialIds: readonly string[];
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyRegistrationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+  }): Promise<WebAuthnRegistrationVerification>;
+  generateAuthenticationOptions(input: {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly allowCredentialIds?: readonly string[];
+    readonly userVerification: "required";
+  }): Promise<WebAuthnOptionsJSON>;
+  verifyAuthenticationResponse(input: {
+    readonly response: unknown;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly expectedRpId: string;
+    readonly credential: {
+      readonly credentialId: string;
+      readonly publicKey: string;
+      readonly counter: number;
+      readonly transports?: readonly string[];
+    };
+  }): Promise<WebAuthnAuthenticationVerification>;
+}